CVE-2026-91986 in gitoxide
Summary
by MITRE • 09/15/2026
gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in gix-transport prior to version 0.59.2 represents a critical input validation failure within the Git transport layer, specifically affecting interactions with git-daemon services. This flaw stems from an insufficient sanitization of control characters embedded within crafted Git URLs used during connection requests. In standard network protocols and data processing pipelines, control characters such as Null (NUL), Carriage Return (CR), and Line Feed (LF) serve specific structural purposes or are strictly prohibited to prevent ambiguity in parsing logic. However, the affected implementation fails to filter these bytes when constructing protocol fields for git-daemon connect requests. This oversight allows an attacker who controls the input URL to inject arbitrary control characters directly into the data stream sent to the server-side daemon process.
The operational impact of this vulnerability is multifaceted and potentially severe depending on the deployment context. By injecting NUL-delimited protocol fields, an attacker can manipulate how the git-daemon interprets connection parameters. Specifically, this capability enables host header spoofing or virtual host manipulation if the underlying infrastructure relies on these headers for routing or access control decisions. Furthermore, the injection of newline characters (CR/LF) into daemon requests and subsequent log entries introduces a risk of Log Injection attacks. If logs are later processed by automated systems that parse lines based on newlines, an attacker can forge log entries to hide malicious activity, inject misleading information, or potentially trigger command execution if those logs are fed into shell commands without proper escaping. This aligns with the Common Weakness Enumeration category CWE-74 for Improper Neutralization of Special Elements in Output Used by a Downstream Component and CWE-117 for Improper Output Neutralization for Logs.
From an offensive security perspective, this vulnerability maps to MITRE ATT&CK techniques related to Command Injection via Log Injection (T1078) or potentially Taint Analysis if the injected data influences subsequent decision-making processes within the application logic. The ability to inject NUL bytes is particularly dangerous in C-based systems where strings are null-terminated, as it can cause premature string termination and lead to buffer over-reads or logical bypasses of security checks that rely on complete string matching. Although git-daemon itself has strict access controls via export-file configurations, the manipulation of request metadata could potentially aid in reconnaissance or evasion techniques against less rigorously configured instances.
Mitigation for this vulnerability requires an immediate upgrade to gix-transport version 0.59.2 or later, where the input validation logic has been hardened to explicitly reject or sanitize control characters within URL components before they are processed by the transport layer. For environments unable to patch immediately, defensive measures should include implementing strict allow-listing of allowed characters in Git URLs at a reverse proxy or load balancer level prior to reaching the application server. Additionally, ensuring that log aggregation systems employ robust parsing rules that do not assume single-line entries can mitigate the impact of any successfully injected newlines. Regular security audits focusing on input validation boundaries are recommended to prevent similar injection flaws across other components of the Git infrastructure stack.